Top Court Strikes Down Alberta Data Protection Legislation

The Supreme Court of Canada has struck down Alberta’s Personal Information Protection Act(PIPA), on the grounds that it violates the guarantee of freedom of expression in the Canadian Charter of Rights and Freedom. The invalidation of the legislation has been suspended for 12 months to give the Alberta government time to amend the legislation so as to bring it into compliance with the Charter.

The conflict between privacy rights and the freedom of expression in Information and Privacy Commissioner of Alberta v. United Food and Commercial Workers, Local 401 arose after an adjudicator under PIPA ruled that the Union’s practice of taking photographs and videotapes of people crossing its picket line during a labour dispute – and of using some of the footage on its website – contravened the data protection statute. Judges at the Alberta Court of Queen’s Bench and the Alberta Court of Appeal had found that to the extent that PIPA restrained the ability of the Union to collect, use and disclose personal information in relation to a labour dispute it violated the Union’s freedom of expression. Although the statute contains a series of exceptions that cover a range of circumstances, none of these exceptions were available to the Union. Some of these exceptions were specifically crafted to balance privacy rights with the freedom of expression, but the exceptions for material collected, used or disclosed “for journalistic purposes and for no other purpose” or “for artistic or literary purposes and for no other purpose” were found not to apply to the Union’s activities. As a result, the limitation on the freedom of expression was not mitigated, and the legislation was found to contravene the Charter.

In substance, the Supreme Court of Canada was of much the same view as the courts below. Emphasizing the importance of freedom of expression in the labour relations context, Justices Abella and Cromwell, for a unanimous court, found that the private sector data protection statute did not properly balance this freedom with privacy rights.

In reaching their decision, Justices Abella and Cromwell emphasized the quasi-constitutional nature of data protection legislation “because of the fundamental role privacy plays in the preservation of a free and democratic society.” (at para 19) The Court also emphasized that control over one’s personal information was of central importance to the human values of autonomy, dignity and privacy. While the court has made statements of this nature before, it is important to hear them used in relation to private sector data protection legislation.

However, the Court criticized PIPA for limiting the collection, use and disclosure of personal information, other than with consent, “without regard for the nature of the personal information, the purpose for which it is collected, used or disclosed, and the situational context for that information.” (para 25). While this may be true in the particular factual context of this case (in other words, there is no exception tailored to the labour relations context) it is not true generally, as PIPA does indeed include a raft of exceptions to the consent principle that are tailored to a wide range of contexts, including investigations, audits, archival purposes, and so on.There are also the above-noted exceptions for journalistic, artistic or literary purposes, and further exceptions for information collected for purely private or domestic purposes. The flaw, it would seem, is that PIPA does not contain an exception crafted to deal with the labour relations context. This is supported by the Court’s statement that “the Act does not include any mechanisms by which a union’s constitutional right to freedom of expression may be balanced with the interests protected by the legislation.” (at para 25) Later in the decision the Court states that “[t]o the extent that PIPA restricted the Union’s collection, use and disclosure of personal information for legitimate labour relations purposes, the Act violates s. 2(b) of the Charter and cannot be justified under s. 1.” (at para 38) It would appear, then, that the constitutional violation is narrowly cast; a fairly straightforward way for the legislature to respond to the Court’s decision would be to craft an exception specifically for the labour relations context.

It is worth noting that the Court also specifies that PIPA is “considerably broader” in scope than the federal private data protection statute, the Personal Information Protection and Electronic Documents Act (PIPEDA). This is because PIPEDA applies only to the collection, use or disclosure of personal information in the course of commercial activity. Thus it would not have applied in the circumstances of this case. PIPA, by contrast, applies to organizations engaged in a much broader range of activities; its application specifically extends to trade unions. The distinction is important: in the unlikely event that the Alberta government does not act to save its legislation, PIPEDA would fill the gap left by PIPA’s invalidation, and would apply to private sector data collection, use and disclosure in the course of commercial activity in Alberta. The distinction also suggests that PIPEDA itself is not at risk of being found unconstitutional on these grounds, and that Parliament need not act to save it from such peril. This is just as well, since Parliament’s inability or unwillingness to reform PIPEDA is by now well-established.

It is noteworthy that the Court states that “[i]t goes without saying that by appearing in public, an individual does not automatically forfeit his or her interest in retaining control over the personal information which is thereby exposed.” (at para 27). It is not to be assumed that this goes without saying. For example, in the Leon’s Furniture decision from the Alberta Court of Appeal, for which leave to appeal to the Supreme Court of Canada was refused, the majority of the Court of Appeal had appeared to find a correlation between private and personal information, suggesting that information in public view was somehow exempt from the reach of data protection legislation. The affirmation by the Supreme Court of Canada that information in public can still be personal information is more important than the Court lets on.

The decision in this case raises issues for British Columbia’s Personal Information Protection Act, which, like its Alberta counterpart, applies to trade unions. It will also have implications for the newly enacted, though not yet in force, Personal Information Protection and Identity Theft Prevention Actin Manitoba. This statute, which has other issues, also extends in its application to unions. The BC and Manitoba legislatures may thus also need to turn their attention to crafting an exception relating to the application of the statute to the labour relations context.